Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    13/03/2024, 02:47

General

  • Target

    c4c717cf99aff48832cecaf67a52b592.exe

  • Size

    757KB

  • MD5

    c4c717cf99aff48832cecaf67a52b592

  • SHA1

    3e949b6fb9c6d67fb9dbec0ae13de1cd8291462b

  • SHA256

    b8ccdce24de3bf276a73ac3a23c23668224735f1e0af0d280868efc8fdbc51a6

  • SHA512

    f9f897b1df7c5b5514a194b078cd0e0e56af325cbf69aeb0722a02cacf03779aa031e08f7f87dbc7406e0f3094beae12ac78463c299a9062933814c1ca58e98c

  • SSDEEP

    12288:gDBqmbrCFtTZk+rgePAmdfzQ1FgflGIGTJ36k6UpkJh6H9LCqPJmRyEAbX8DzX0/:CBpWFtTi+1PAqzQ1FuGBTphW0/r8P0Tj

Malware Config

Signatures

  • Nirsoft 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe
    "C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe
      C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1792
      • C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe
        /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2596
      • C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe
        /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:2780
      • C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe
        /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
        3⤵
          PID:2520
        • C:\Users\Admin\AppData\Local\Temp\c4c717cf99aff48832cecaf67a52b592.exe
          /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2544

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1792-19-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/1792-4-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/1792-6-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/1792-12-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/1792-9-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/1792-15-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/1792-27-0x0000000000220000-0x000000000022A000-memory.dmp

      Filesize

      40KB

    • memory/1792-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1792-22-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1792-142-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1792-141-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1792-136-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1792-2-0x0000000000400000-0x00000000004BE000-memory.dmp

      Filesize

      760KB

    • memory/2596-43-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2596-37-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2596-35-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2596-33-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2596-40-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2596-51-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2596-50-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2596-46-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2780-59-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/2780-61-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/2780-63-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/2780-66-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB